1、实验拓扑搭建
2、配置参数
（1）PC1
（2）PC2
（3）SW1配置参数
[SW1]vlan batch 10 20 [SW1]interface Ethernet0/0/1 [SW1-Ethernet0/0/1]display this # interface Ethernet0/0/1 port link-type access port default vlan 10 # return [SW1-Ethernet0/0/1] [SW1]interface Ethernet0/0/2 [SW1-Ethernet0/0/2]display this # interface Ethernet0/0/2 port link-type access port default vlan 20 # return [SW1-Ethernet0/0/2]quit [SW1]interface GigabitEthernet 0/0/1 [SW1-GigabitEthernet0/0/1]dis thi # interface GigabitEthernet0/0/1 port link-type trunk undo port trunk allow-pass vlan 1 port trunk allow-pass vlan 10 20 # return [SW1-GigabitEthernet0/0/1]
（4）AR1配置参数（合法路由器）
[AR1]dhcp enable [AR1]ip pool TV [AR1-ip-pool-TV]display this [V200R003C00] # ip pool TV gateway-list 10.1.1.254 network 10.1.1.0 mask 255.255.255.0 excluded-ip-address 10.1.1.1 lease day 2 hour 2 minute 2 dns-list 202.99.99.99 # return [AR1-ip-pool-TV]quit [AR1]ip pool VT [AR1-ip-pool-VT]dis thi [V200R003C00] # ip pool VT gateway-list 20.1.1.254 network 20.1.1.0 mask 255.255.255.0 excluded-ip-address 20.1.1.1 lease day 2 hour 2 minute 2 dns-list 202.99.99.99 # return [AR1-ip-pool-VT]quit [AR1]interface GigabitEthernet 0/0/0.1 [AR1-GigabitEthernet0/0/0.1]display this [V200R003C00] # interface GigabitEthernet0/0/0.1 dot1q termination vid 10 ip address 10.1.1.254 255.255.255.0 arp broadcast enable dhcp select global # return [AR1-GigabitEthernet0/0/0.1] [AR1-GigabitEthernet0/0/0.2]dis thi [V200R003C00] # interface GigabitEthernet0/0/0.2 dot1q termination vid 20 ip address 20.1.1.254 255.255.255.0 arp broadcast enable dhcp select global # return [AR1-GigabitEthernet0/0/0.2]
（5）AR2配置参数（黑客路由器）
[HEIKE]dhcp enable Info: The operation may take a few seconds. Please wait for a moment.done. [HEIKE]ip pool IT Info: It's successful to create an IP address pool. [HEIKE-ip-pool-IT]gateway-list 1.1.1.254 [HEIKE-ip-pool-IT]network 1.1.1.0 mask 255.255.255.0 [HEIKE-ip-pool-IT]dns-list 202.99.99.99 [HEIKE-ip-pool-IT]lease day 2 hour 2 minute 2 [HEIKE-ip-pool-IT]excluded-ip-address 1.1.1.1 [HEIKE-ip-pool-IT]display this [V200R003C00] # ip pool IT gateway-list 1.1.1.254 network 1.1.1.0 mask 255.255.255.0 excluded-ip-address 1.1.1.1 lease day 2 hour 2 minute 2 dns-list 202.99.99.99 # return [HEIKE]ip pool HR Info: It's successful to create an IP address pool. [HEIKE-ip-pool-HR] [HEIKE-ip-pool-HR] gateway-list 2.2.2.254 [HEIKE-ip-pool-HR] [HEIKE-ip-pool-HR] network 2.2.2.0 mask 255.255.255.0 [HEIKE-ip-pool-HR] [HEIKE-ip-pool-HR] excluded-ip-address 2.2.2.2 [HEIKE-ip-pool-HR] [HEIKE-ip-pool-HR] lease day 2 hour 2 minute 2 [HEIKE-ip-pool-HR] [HEIKE-ip-pool-HR] dns-list 202.99.99.99 [HEIKE-ip-pool-HR]dis thi [V200R003C00] # ip pool HR gateway-list 2.2.2.254 network 2.2.2.0 mask 255.255.255.0 excluded-ip-address 2.2.2.2 lease day 2 hour 2 minute 2 dns-list 202.99.99.99 # return [HEIKE-ip-pool-HR]quit [HEIKE]interface GigabitEthernet 0/0/0.1 [HEIKE-GigabitEthernet0/0/0.1]ip address 1.1.1.254 24 [HEIKE-GigabitEthernet0/0/0.1]dot1q termination vid 10 Jul 30 2020 10:42:56-08:00 HEIKE %%01IFNET/4/LINK_STATE(l)[2]:The line protocol IP on the interface GigabitEthernet0/0/0.1 has entered the UP state. [HEIKE-GigabitEthernet0/0/0.1]arp broadcast enable [HEIKE-GigabitEthernet0/0/0.1]dis thi [V200R003C00] # interface GigabitEthernet0/0/0.1 dot1q termination vid 10 ip address 1.1.1.254 255.255.255.0 arp broadcast enable # return [HEIKE-GigabitEthernet0/0/0.1] [HEIKE]interface GigabitEthernet 0/0/0.2 [HEIKE-GigabitEthernet0/0/0.2]ip address 2.2.2.254 24 [HEIKE-GigabitEthernet0/0/0.2]dot1q termination vid 20 Jul 30 2020 10:44:30-08:00 HEIKE %%01IFNET/4/LINK_STATE(l)[3]:The line protocol IP on the interface GigabitEthernet0/0/0.2 has entered the UP state. [HEIKE-GigabitEthernet0/0/0.2]arp broadcast enable [HEIKE-GigabitEthernet0/0/0.2]dis thi [V200R003C00] # interface GigabitEthernet0/0/0.2 dot1q termination vid 20 ip address 2.2.2.254 255.255.255.0 arp broadcast enable # return # 子接口下启用全局DHCP [HEIKE-GigabitEthernet0/0/0.2]dhcp select global [HEIKE-GigabitEthernet0/0/0.2]dis thi [V200R003C00] # interface GigabitEthernet0/0/0.2 dot1q termination vid 20 ip address 2.2.2.254 255.255.255.0 arp broadcast enable dhcp select global # return [HEIKE-GigabitEthernet0/0/0.2] [HEIKE]interface GigabitEthernet 0/0/0.1 [HEIKE-GigabitEthernet0/0/0.1]dhcp select global [HEIKE-GigabitEthernet0/0/0.1]dis thi [V200R003C00] # interface GigabitEthernet0/0/0.1 dot1q termination vid 10 ip address 1.1.1.254 255.255.255.0 arp broadcast enable dhcp select global # return [HEIKE-GigabitEthernet0/0/0.1]
3、防护措施设置
使用DHCP Snooping防范DHCP欺骗攻击
DHCP 欺骗攻击过程：
1.首先攻击者伪装成DHCP客户端，发起大量的DHCP请求(可以用软件实现)。DHCP服务器收到请求后，把IP分配给伪装的DHCP客户端，由于DHCP服务器的IP地址数量是有限的，很快DHCP服务器上地址池的IP就会被消耗完，则DHCP服务器不再为其它客户端分配IP
2.第一步完成后，攻击者这时可以搭建一台DHCP服务器，则客户端的DHCP请求就会到非法的DHCP上请求IP,从而获取一个非法的IP地址。
DHCP Snpooing配置：
1.全局启用dhcp snooping
SW1-GigabitEthernet0/0/1
dhcp snooping enable
……………………………………………………………………………
2.将相应的端口（连接合法DHCP服务器的端口）划入trusted
SW1-GigabitEthernet0/0/1
dhcp snooping trusted
……………………………………………………………………………
3.SW1全局dhcp snooping和所连接的接口dhcp snooping都要开启
dhcp snooping enable
………………………………………………………………………………
4.开启dhcp snooping 防护功能时，要先开启DHCP服务（即dhcp enable）
dhcp enable
dhcp snooping enable
# 防护措施，在交换机的GE 0/0/1上设置参数 [SW1]dhcp enable Info: The operation may take a few seconds. Please wait for a moment.done. [SW1]dhcp snooping enable //全局开启dhcp snooping [SW1] Jul 30 2020 11:33:38-08:00 SW1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25 .191.3.1 configurations have been changed. The current change number is 23, the change loop count is 0, and the maximum number of records is 4095. [SW1]interface GigabitEthernet 0/0/1 [SW1-GigabitEthernet0/0/1]dhcp snooping trusted Jul 30 2020 11:35:18-08:00 SW1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25 .191.3.1 configurations have been changed. The current change number is 24, the change loop count is 0, and the maximum number of records is 4095. [SW1-GigabitEthernet0/0/1]dis thi # interface GigabitEthernet0/0/1 port link-type trunk undo port trunk allow-pass vlan 1 port trunk allow-pass vlan 10 20 dhcp snooping trusted # return [SW1-GigabitEthernet0/0/1] [SW1-GigabitEthernet0/0/1]dhcp snooping enable [SW1-GigabitEthernet0/0/1]dis thi # interface GigabitEthernet0/0/1 port link-type trunk undo port trunk allow-pass vlan 1 port trunk allow-pass vlan 10 20 dhcp snooping enable dhcp snooping trusted # return [SW1-GigabitEthernet0/0/1] [SW1]interface Ethernet0/0/3 [SW1-Ethernet0/0/3]dhcp snooping enable Jul 30 2020 11:39:08-08:00 SW1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25 .191.3.1 configurations have been changed. The current change number is 25, the change loop count is 0, and the maximum number of records is 4095. [SW1-Ethernet0/0/3]dis thi # interface Ethernet0/0/3 port link-type trunk port trunk allow-pass vlan 10 20 dhcp snooping enable # return [SW1-Ethernet0/0/3]
4、PC1 获取DHCP地址
5、PC2 获取DHCP地址
6、中断合法AR1端口后，验证PC能否正常获取DHCP
当交换机GE 0/0/1的端口与AR1的GE 0/0/0的合法端口通信中断后，Pc1和Pc2重新获取DHCP地址时，无法获取。如图所示。
[AR1]interface GigabitEthernet 0/0/0 [AR1-GigabitEthernet0/0/0]shutdown Jul 30 2020 12:15:15-08:00 AR1 %%01IFPDT/4/IF_STATE(l)[0]:Interface GigabitEther net0/0/0 has turned into DOWN state. [AR1-GigabitEthernet0/0/0] Jul 30 2020 12:15:15-08:00 AR1 %%01IFNET/4/LINK_STATE(l)[1]:The line protocol IP on the interface GigabitEthernet0/0/0.1 has entered the DOWN state. [AR1-GigabitEthernet0/0/0] Jul 30 2020 12:15:15-08:00 AR1 %%01IFNET/4/LINK_STATE(l)[2]:The line protocol IP on the interface GigabitEthernet0/0/0.2 has entered the DOWN state. [AR1-GigabitEthernet0/0/0]
至此，防护措施已生效。
